npm-package-authoringlisted

# npm Package Authoring Produce a consumer-valid tarball before touching the registry. Treat `package.json`, the packed tarball, the isolated installed package, the authentication mechanism, and registry state as separate contracts. ## Operating contract - Inspect repository instructions, dirty state, lockfiles, supported Node/npm versions, workspace topology, and the existing release workflow first. - Preserve unrelated changes. Never make a release from an unexplained dirty tree. - Build once, pack once, retain the exact `.tgz`, and publish that retained tarball. - Test the installed tarball outside the repository; source-tree tests cannot prove package correctness. - Run cross-platform package tests on every supported OS. Do not weaken Windows assertions to imitate POSIX. - Query registry state before every publish attempt and after every ambiguous outcome. Never blind-retry `npm publish`. - Prefer npm OIDC trusted publishing over long-lived write tokens. - Report local, CI, tarball, authentication, registry, and published-consumer evidence separately. All shell blocks are Bash unless marked PowerShell. Use Node scripts for portable parsing instead of platform-specific `sed`, `grep`, or path assumptions. ## 1. Establish ground truth Run from the repository root: ```bash set -euo pipefail git status --short node --version npm --version npm config get registry npm pkg get name version private packageManager engines repository publishConfig files exports bin workspaces